An event is an abstraction of a set of events if it summarizes, represents, or denotes that set of events.

Something from which events are acquired (for example, a router or a server).

Module contained in an agent that collects event data. Each module is given an endpoint from which to collect data, and a mechanism configuration. One or more adapters can be managed by an agent.

An event is an aggregation of two or more events if it is composed of elements of those events.

The fundamental organization of a system embodied in its components, their relationships to each other and to the environment, and the principles guiding its design and evolution.

A coordinated set of architectural constraints that restricts the roles or features of architectural elements and the allowed relationships among those elements within any architecture that conforms to that style.

Transfers information to the archive (EMC Centera).

An event A is a cause of another event B if A had to happen in order for B to happen.

An event channel is a conduit in which events are transmitted from event sources (emitters) to event sinks (consumers). A channel can carry events of multiple types. An event channel may be public (without access restrictions) or controlled. An event channel is a medium for delivering one or more event streams. A single event channel may be consumed by multiple event consumers.

Widget placed in a Perspective dashboard to visually represent event field values. The widget displays a line chart using up to four event fields. Background color, axis labels, and time period can be configured.

Process that creates an ordered ascending sequence of values of type Time with a uniform interval between them. Each value is produced at a tick (or clock tick).

An event that is an abstraction or aggregation of other events called its members. An aggregation is a composition of 2 or more member events, but always a bounded number of member events. However, it is possible for one event to abstract a single event, or indeed an unknown number of member events. Therefore all aggregation is abstraction, but some abstractions are not aggregations. Note: Saying that a complex event “references” the set of its members should probably be avoided, since it implies that the event’s members can be determined from the reference, and this is not always true (for example, there is no accepted agreement as to which events are members of the 1929 stock market crash).

Computing that performs operations on complex events, including reading, creating, transforming, or abstracting them. Complex event processing (CEP) identifies event patterns from a cloud of multiple events, which can occur over a long period of time. Depending on the event pattern, an action can be triggered. Pattern relationships may consist of membership, casual, temporal, or spatial connections.

Composite event types are aggregated event types that are created by combining other primitive or composite event types using a specific set of event constructors such as disjunction, conjunction, sequence, etc.

A Boolean condition that must be satisfied by the events observed in a system.

Visual representation of event values in Perspective(for example, a collection of graphs or dials).

An event that is generated as a result of applying an algorithmic function or process to one or more separate events.

Widget placed in a Perspective dashboard to visually represent an event field value. A dial is depicted as a circle with three colored zones, and a pointer. Zone limits for the dial can be configured.

Deployment role of Occurrence that is usually deployed in the center of an EPN. A Director does not normally collect events directly, but receives them through a relay.

Deployment role of Occurrence that collects events directly from devices such as network infrastructure, corporate applications, and internet-based applications. Collectors can also gather event data from Edge Probes.

A low-volume Event Zero appliance device that is typically deployed in a remote office, and an agent with 1-5 logical endpoints.

Event Processing Network

In event processing, the word “event” is used to denote both the everyday meaning (something that happens) and the computer science meaning (an event object or message). The context of each use indicates which meaning is intended.

The generic term for the software that connects to an Event Source. Event adapters come in 3 categories: agent, scout, and probe. Listeners, Probes and Scouts

A component of the structure of an event. An attribute can have a simple or complex data type.

See Channel

A partially ordered set of events (poset), either bounded or unbounded, where the partial orderings are imposed by the causal, timing, and other relationships between the events. An event cloud is typically created by the events produced by one or more distributed systems. An event cloud may contain many event types, event streams, and event channels. The difference between a cloud and a stream is that there is no event relationship that totally orders the events in a cloud. A stream is a cloud, but the converse is not necessarily true.

An architectural style in which some of the components are event driven and communicate by means of events.

Behavior of a device, software module or other entity whose execution is in response to events from external or internal sources.

Event Zero processing engine software that provides the ability to collect, queue, forward, and archive events in real time. Occurrence can be deployed in different roles such as Director, Relay and Edge Collector, all of which act together to make up an EPN.

A template containing event templates, relational operators and variables. An event pattern can match sets of related events by replacing variables with values.

Event Zero visualization and analytics software that provides the ability to explore event data streams in both real time (via dashboards or dynamic event stream inspection) and asynchronously (via reports). Event Perspective also contains an Incident/Case Management/Workflow application which is used by operations analysts to interact with situations detected by event stream data.

Computing that performs operations on events, including reading, creating, transforming, and deleting events.

A software module that processes events. Event source and event sink are roles that an EPA may play. One EPA could act in both roles; it could be an event source at one moment, an event sink at another time.

A high-level computer language for defining the behavior of event processing agents.

A set of event processing agents (EPAs) and a set of event channels connecting them.

An entity that receives events.

An entity that sends events.

A linearly ordered sequence of events. Streams are normally ordered by time (for example, arrival time). An event stream may be bounded by a certain time interval or other criteria (content, space, or source), or be open ended and unbounded. A stream may contain different types of events.

In ESP, simple events are filtered and the results are streamed to information subscribers.

An event form or descriptor, some of whose parameters are variables. An event template matches single events by replacing the variables with values.

The time value attributes of an event as recorded by a clock in the system in which the event was created or observed.

An event with a single timestamp signifying the time the event took to happen. This is the special case where the time interval of the event has length zero. The event happens at the time of the timestamp (that is, instantaneously).

Generic name for event adapter type. For example, an adapter can be configured to use the mechanism ‘XML Probe’.

Used by adapter to determine the format of event data that is being collected.

Each configuration consists of:

• Mechanism type, which determines how events are collected (for example, HTTP listener).
• Type-specific parameters (for example, the information source or polling schedule).
• Conversion rules, which dictates how fields will map to the displaying channel's schema fields.

Determines the method of event data collection in an adapter.

Mechanism types fall into three categories:

• Listener, which passively receives event data via the network (for example, syslog or SNMP PDU traps).
• Probe, which actively collects event data via the network (for example, reading XML over HTTP or SNMP queries).
• Scout, which actively collects data from the host machine (for example, tailing a file or collecting events from Windows Event log in a Microsoft Windows platform).

See Event Occurrence

Any deployed instance of an Occurrence server within an Occurrence EPN.

Term used to describe an implementation of an EPN using Occurrence as a base.

Set of related events resulting from an event pattern by replacing the variables by values. Example: Send(John, “See the NYT today”, 15.00 EST) and Receive(John, “See the NYT today”, 12.05 PST).

Director that is deployed in the center of an EPN. If required, all events can roll up to this Occurrence Node. The Primary Director is responsible for hosting the global configuration for the entire Occurrence Platform.

Either (1) the definition of what events to collect, and how, from an acquisition source or (2)the act of collecting events, that is, 'profiling' a device.

An event object that records a real-world event. A raw event may represent a simple real-world event (for example, the phone rang) or a complex real-world event (the stock market crash of 1929 was a complex real world event that can be recorded by a complex raw event).

Events are related by time, causality, aggregation, abstraction and other relationships. Time and causality impose partial orderings upon events.

Deployment role of Occurrence that collates events from one or more of Edge Probes or Edge Collectors, spooling each event into a persistent queue, and then forwarding it on to either a parent relay or a larger Edge Collector.

In event processing, a rule is a prescribed method for processing events. Event processing rules may be prescribed in many different ways, including by finite state machines, UML diagrams, graphical methods, Java code, SQL code, ECA (event-condition-action) rules or reactive rules that are triggered by event patterns.

A represention of an event field value in a subchannel.

Simple events are related to specific, measurable condition changes. A simple event is not an abstraction or composition of other events. In simple event processing, an action is triggered by the change. An example of a simple event is a computer error which is written into a system log.

Calculations used in dashboards to manipulate event values (for example, dividing by a factor to make the value more understandable).

Duration of time consisting of two timestamps, which are the end points of the interval (called the interval’s start time and end time). Typically an event will have a time interval attribute which represents the time it took to happen.

Time value attribute of an event. A timestamp is associated with the clock whose reading was used to create it.

An event that does not happen in the physical world but appears to signify a real world event; an event that is imagined or modeled or simulated.

A bounded portion of an event stream. Windows define subsequences of an event stream typically to focus the event processing on specific data, or to improve event processing performance, but may also have other uses. Example: The events in the last ten minutes (that is, a ten-minute moving window).